CVE-2015-8125

07.12.2015, 20:59

Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener class in the Symfony Security Component, or (3) legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Vector
NIST	NIST	7.5 UNKNOWN	NETWORK	LOW	AV:N/AC:L/Au:N/C:P/I:P/A:P
mitre	CNA	---			---
CVE	ADP	---			---

Base Score

CVSS 3.x

EPSS Score

Percentile: 74%

Vendor	Product	Version
sensiolabs	symfony	2.3.0
sensiolabs	symfony	2.3.1
sensiolabs	symfony	2.3.2
sensiolabs	symfony	2.3.3
sensiolabs	symfony	2.3.4
sensiolabs	symfony	2.3.5
sensiolabs	symfony	2.3.6
sensiolabs	symfony	2.3.7
sensiolabs	symfony	2.3.8
sensiolabs	symfony	2.3.9
sensiolabs	symfony	2.3.10
sensiolabs	symfony	2.3.11
sensiolabs	symfony	2.3.12
sensiolabs	symfony	2.3.13
sensiolabs	symfony	2.3.14
sensiolabs	symfony	2.3.15
sensiolabs	symfony	2.3.16
sensiolabs	symfony	2.3.17
sensiolabs	symfony	2.3.18
sensiolabs	symfony	2.3.19
sensiolabs	symfony	2.3.20
sensiolabs	symfony	2.3.21
sensiolabs	symfony	2.3.22
sensiolabs	symfony	2.3.23
sensiolabs	symfony	2.3.24
sensiolabs	symfony	2.3.25
sensiolabs	symfony	2.3.26
sensiolabs	symfony	2.3.27
sensiolabs	symfony	2.3.28
sensiolabs	symfony	2.3.29
sensiolabs	symfony	2.3.30
sensiolabs	symfony	2.3.31
sensiolabs	symfony	2.3.32
sensiolabs	symfony	2.3.33
sensiolabs	symfony	2.3.34
sensiolabs	symfony	2.6.0
sensiolabs	symfony	2.6.1
sensiolabs	symfony	2.6.2
sensiolabs	symfony	2.6.3
sensiolabs	symfony	2.6.4
sensiolabs	symfony	2.6.5
sensiolabs	symfony	2.6.6
sensiolabs	symfony	2.6.7
sensiolabs	symfony	2.6.8
sensiolabs	symfony	2.6.9
sensiolabs	symfony	2.6.10
sensiolabs	symfony	2.6.11
sensiolabs	symfony	2.7.0
sensiolabs	symfony	2.7.1
sensiolabs	symfony	2.7.2
sensiolabs	symfony	2.7.3
sensiolabs	symfony	2.7.4
sensiolabs	symfony	2.7.5
sensiolabs	symfony	2.7.6